CVE-2024-36108 Multiple Broken Function-Level Authorization vulnerabilities in casgate

casgate is an Open Source Identity and Access Management system. In affected versions casgate allows remote unauthenticated attacker to obtain sensitive information via GET request to an API endpoint. This issue has been addressed in PR 201 which is pending merge. An attacker could use id paramet...

CVE-2024-4205

The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the gettemplatecontent function in all versions up to, and including, 4.10.31. This makes it possible for authenticated attackers, with subscriber-level access a...

SUSE CVE-2024-36015

In the Linux kernel, the following vulnerability has been resolved: ppdev: Add an error check in registerdevice In registerdevice, the return value of idasimpleget is unchecked, in witch idasimpleget will use an invalid index value. To address this issue, index should be checked after idasimplege...

PT-2024-29709 · WordPress · Premium Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Premium Addons for Elementor plugin for WordPress versions up to, and including, 4.10.31 Description: The issue allows authenticated attackers with subscriber-level access and above to retrieve Elementor template data due to a missing...

PT-2024-40336 · Symfony2 · Symfony2

Name of the Vulnerable Software and Affected Versions: Symfony2 versions prior to the fixed version Description: A security issue was found in the Request::getClientIp method when the trust proxy mode is enabled. This issue affects applications that use the client IP address for sensitive decisio...

DEBIAN-CVE-2024-36015

In the Linux kernel, the following vulnerability has been resolved: ppdev: Add an error check in registerdevice In registerdevice, the return value of idasimpleget is unchecked, in witch idasimpleget will use an invalid index value. To address this issue, index should be checked after idasimplege...

UBUNTU-CVE-2024-36015

In the Linux kernel, the following vulnerability has been resolved: ppdev: Add an error check in registerdevice In registerdevice, the return value of idasimpleget is unchecked, in witch idasimpleget will use an invalid index value. To address this issue, index should be checked after idasimplege...

(Pwn2Own) Phoenix Contact CHARX SEC-3100 OCPP charx_pack_logs Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Phoenix Contact CHARX SEC-3100 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the Charger ID parameter to the Get...

CVE-2023-43843

Incorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to read user and administrator accounts passwords via HTTP GET request...

CVE-2023-43843

Incorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to read user and administrator accounts passwords via HTTP GET request...

CVE-2023-43843

Incorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to read user and administrator accounts passwords via HTTP GET request...

CVE-2024-33804

A SQL injection vulnerability in /model/getsubject.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the id parameter...

CVE-2024-33807

A SQL injection vulnerability in /model/getteachertimetable.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the grade parameter...

CVE-2024-33808

A SQL injection vulnerability in /model/gettimetable.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the id parameter...

silverstripe/graphql Cross-Site Request Forgery vulnerability

The GraphQL controller lacked any CSRF protection, meaning authenticated users could be forced or tricked into visiting a URL that would send a GET request to the affected web server that could mutate or destroy data without the user knowing...

Cross-Site Request Forgery (CSRF)

Silverstripe/forum is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to form actions being directly accessible, allowing an attacker to use GET requests to create members and post to forums, and tricking moderators into clicking crafted URLs to move topics...

SUSE CVE-2021-47394

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: unlink table before deleting it syzbot reports following UAF: BUG: KASAN: use-after-free in memcmp+0x18f/0x1c0 lib/string.c:955 nlastrcmp+0xf2/0x130 lib/nlattr.c:836 nfttablelookup.part.0+0x1a2/0x460...

SUSE CVE-2021-47540

In the Linux kernel, the following vulnerability has been resolved: mt76: mt7915: fix NULL pointer dereference in mt7915getphymode Fix the following NULL pointer dereference in mt7915getphymode routine adding an ibss interface to the mt7915 driver. 101.137097 wlan0: Trigger new scan to find an IB...

PT-2024-25485 · Unknown · Campcodes Complete Web-Based School Management System

Name of the Vulnerable Software and Affected Versions: campcodes Complete Web-Based School Management System version 1.0 Description: A SQL injection issue allows an attacker to execute arbitrary SQL commands via the id parameter in the "/model/get teacher.php" API endpoint. Recommendations: For...

PT-2024-25491 · Unknown · Campcodes Complete Web-Based School Management System

Name of the Vulnerable Software and Affected Versions: campcodes Complete Web-Based School Management System version 1.0 Description: A SQL injection issue allows an attacker to execute arbitrary SQL commands via the id parameter in the "/model/get subject.php" API endpoint. Recommendations: For...